Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
03/05/2024, 20:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
37a558f0bdcbcf158df20f0f0e32f532774cb91f05a4c06e11e1ce6ec04ab4f9.exe
Resource
win7-20231129-en
6 signatures
150 seconds
General
-
Target
37a558f0bdcbcf158df20f0f0e32f532774cb91f05a4c06e11e1ce6ec04ab4f9.exe
-
Size
93KB
-
MD5
c594efd69a4ad1586e3aa2f1e48e6f7c
-
SHA1
00c1f171670367fe20f7a496b0f4c8ef17c2d270
-
SHA256
37a558f0bdcbcf158df20f0f0e32f532774cb91f05a4c06e11e1ce6ec04ab4f9
-
SHA512
419f9cc27c85170d9dea63a54e7c6a61c3e6d2a385fd153eb7af51114da531896998283b8409a808bf3bc0004c3f48e48ce926347392d47767c709b32cd881f5
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIkpi+qP1hvZo66Ox4oq2SQwfTrB:ymb3NkkiQ3mdBjFIj+qNhvZuHQYfB
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral1/memory/2180-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2248-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2932-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2748-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2812-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2716-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2456-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1520-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2000-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/764-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1080-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1200-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1576-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2492-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2112-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3060-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1500-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/820-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1872-242-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3024-259-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/980-268-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1508-277-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1336-286-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2976-295-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 33 IoCs
resource yara_rule behavioral1/memory/2180-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2248-13-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2932-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2748-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2748-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2748-32-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2748-42-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2676-46-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2676-47-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2676-45-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2676-56-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2812-60-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2812-59-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2812-69-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2716-73-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2456-83-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1520-106-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2000-116-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/764-134-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1080-152-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1200-160-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1576-170-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2492-188-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2112-196-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3060-206-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1500-224-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/820-232-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1872-242-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3024-259-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/980-268-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1508-277-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1336-286-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2976-295-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2248 lflrrlf.exe 2932 thntbh.exe 2748 bttntn.exe 2676 vjvvv.exe 2812 nhnbnh.exe 2716 dpddp.exe 2456 pdjjj.exe 768 rffffff.exe 1520 1xfxfxx.exe 2000 9tnntt.exe 320 vpvjj.exe 764 dvpjp.exe 1992 lrxrrrr.exe 1080 frlrxxf.exe 1200 tnttbh.exe 1576 7bnttn.exe 1772 3jjpj.exe 2492 frxfffr.exe 2112 xlxrxxl.exe 3060 htbhhh.exe 780 vpdjp.exe 1500 jvppp.exe 820 lxrrrxr.exe 1872 xflxxxx.exe 1164 1bnhnn.exe 3024 thbnhb.exe 980 vjdvj.exe 1508 9lxllfl.exe 1336 9rrrrrx.exe 2976 thtttt.exe 2272 9jddv.exe 2808 7pjjj.exe 1364 flrrllr.exe 1136 rlrxfxx.exe 2300 nhbhhh.exe 2260 btttnh.exe 2692 pdvpp.exe 2816 xlrrxrl.exe 2284 lrfxffl.exe 2640 3rxrlfl.exe 2480 bthhnn.exe 2716 5hthbt.exe 2576 1pppj.exe 2076 djjjv.exe 3036 rrrrxrr.exe 2212 9lrrrrl.exe 1616 hbnttn.exe 940 thhbbb.exe 1824 dpjdv.exe 2016 pdjpv.exe 2164 7xxrllx.exe 1724 lxrxxrx.exe 1680 ntbtbn.exe 1572 hbbnhb.exe 2872 5ttnhb.exe 2092 7pjjv.exe 2116 5jvvp.exe 324 lffrrfl.exe 1964 rfllxrx.exe 780 nttntt.exe 748 nbnhhh.exe 2204 pdpvp.exe 328 1vppv.exe 1872 flxrxxf.exe -
resource yara_rule behavioral1/memory/2180-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2248-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2932-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1520-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2000-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/764-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1080-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1200-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1576-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2492-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2112-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3060-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1500-224-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/820-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1872-242-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3024-259-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/980-268-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1508-277-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1336-286-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2976-295-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2180 wrote to memory of 2248 2180 37a558f0bdcbcf158df20f0f0e32f532774cb91f05a4c06e11e1ce6ec04ab4f9.exe 28 PID 2180 wrote to memory of 2248 2180 37a558f0bdcbcf158df20f0f0e32f532774cb91f05a4c06e11e1ce6ec04ab4f9.exe 28 PID 2180 wrote to memory of 2248 2180 37a558f0bdcbcf158df20f0f0e32f532774cb91f05a4c06e11e1ce6ec04ab4f9.exe 28 PID 2180 wrote to memory of 2248 2180 37a558f0bdcbcf158df20f0f0e32f532774cb91f05a4c06e11e1ce6ec04ab4f9.exe 28 PID 2248 wrote to memory of 2932 2248 lflrrlf.exe 29 PID 2248 wrote to memory of 2932 2248 lflrrlf.exe 29 PID 2248 wrote to memory of 2932 2248 lflrrlf.exe 29 PID 2248 wrote to memory of 2932 2248 lflrrlf.exe 29 PID 2932 wrote to memory of 2748 2932 thntbh.exe 30 PID 2932 wrote to memory of 2748 2932 thntbh.exe 30 PID 2932 wrote to memory of 2748 2932 thntbh.exe 30 PID 2932 wrote to memory of 2748 2932 thntbh.exe 30 PID 2748 wrote to memory of 2676 2748 bttntn.exe 31 PID 2748 wrote to memory of 2676 2748 bttntn.exe 31 PID 2748 wrote to memory of 2676 2748 bttntn.exe 31 PID 2748 wrote to memory of 2676 2748 bttntn.exe 31 PID 2676 wrote to memory of 2812 2676 vjvvv.exe 32 PID 2676 wrote to memory of 2812 2676 vjvvv.exe 32 PID 2676 wrote to memory of 2812 2676 vjvvv.exe 32 PID 2676 wrote to memory of 2812 2676 vjvvv.exe 32 PID 2812 wrote to memory of 2716 2812 nhnbnh.exe 33 PID 2812 wrote to memory of 2716 2812 nhnbnh.exe 33 PID 2812 wrote to memory of 2716 2812 nhnbnh.exe 33 PID 2812 wrote to memory of 2716 2812 nhnbnh.exe 33 PID 2716 wrote to memory of 2456 2716 dpddp.exe 34 PID 2716 wrote to memory of 2456 2716 dpddp.exe 34 PID 2716 wrote to memory of 2456 2716 dpddp.exe 34 PID 2716 wrote to memory of 2456 2716 dpddp.exe 34 PID 2456 wrote to memory of 768 2456 pdjjj.exe 35 PID 2456 wrote to memory of 768 2456 pdjjj.exe 35 PID 2456 wrote to memory of 768 2456 pdjjj.exe 35 PID 2456 wrote to memory of 768 2456 pdjjj.exe 35 PID 768 wrote to memory of 1520 768 rffffff.exe 36 PID 768 wrote to memory of 1520 768 rffffff.exe 36 PID 768 wrote to memory of 1520 768 rffffff.exe 36 PID 768 wrote to memory of 1520 768 rffffff.exe 36 PID 1520 wrote to memory of 2000 1520 1xfxfxx.exe 37 PID 1520 wrote to memory of 2000 1520 1xfxfxx.exe 37 PID 1520 wrote to memory of 2000 1520 1xfxfxx.exe 37 PID 1520 wrote to memory of 2000 1520 1xfxfxx.exe 37 PID 2000 wrote to memory of 320 2000 9tnntt.exe 38 PID 2000 wrote to memory of 320 2000 9tnntt.exe 38 PID 2000 wrote to memory of 320 2000 9tnntt.exe 38 PID 2000 wrote to memory of 320 2000 9tnntt.exe 38 PID 320 wrote to memory of 764 320 vpvjj.exe 39 PID 320 wrote to memory of 764 320 vpvjj.exe 39 PID 320 wrote to memory of 764 320 vpvjj.exe 39 PID 320 wrote to memory of 764 320 vpvjj.exe 39 PID 764 wrote to memory of 1992 764 dvpjp.exe 40 PID 764 wrote to memory of 1992 764 dvpjp.exe 40 PID 764 wrote to memory of 1992 764 dvpjp.exe 40 PID 764 wrote to memory of 1992 764 dvpjp.exe 40 PID 1992 wrote to memory of 1080 1992 lrxrrrr.exe 41 PID 1992 wrote to memory of 1080 1992 lrxrrrr.exe 41 PID 1992 wrote to memory of 1080 1992 lrxrrrr.exe 41 PID 1992 wrote to memory of 1080 1992 lrxrrrr.exe 41 PID 1080 wrote to memory of 1200 1080 frlrxxf.exe 42 PID 1080 wrote to memory of 1200 1080 frlrxxf.exe 42 PID 1080 wrote to memory of 1200 1080 frlrxxf.exe 42 PID 1080 wrote to memory of 1200 1080 frlrxxf.exe 42 PID 1200 wrote to memory of 1576 1200 tnttbh.exe 43 PID 1200 wrote to memory of 1576 1200 tnttbh.exe 43 PID 1200 wrote to memory of 1576 1200 tnttbh.exe 43 PID 1200 wrote to memory of 1576 1200 tnttbh.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\37a558f0bdcbcf158df20f0f0e32f532774cb91f05a4c06e11e1ce6ec04ab4f9.exe"C:\Users\Admin\AppData\Local\Temp\37a558f0bdcbcf158df20f0f0e32f532774cb91f05a4c06e11e1ce6ec04ab4f9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\lflrrlf.exec:\lflrrlf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\thntbh.exec:\thntbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\bttntn.exec:\bttntn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\vjvvv.exec:\vjvvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\nhnbnh.exec:\nhnbnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\dpddp.exec:\dpddp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\pdjjj.exec:\pdjjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\rffffff.exec:\rffffff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\1xfxfxx.exec:\1xfxfxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\9tnntt.exec:\9tnntt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\vpvjj.exec:\vpvjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\dvpjp.exec:\dvpjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\lrxrrrr.exec:\lrxrrrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\frlrxxf.exec:\frlrxxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\tnttbh.exec:\tnttbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\7bnttn.exec:\7bnttn.exe17⤵
- Executes dropped EXE
PID:1576 -
\??\c:\3jjpj.exec:\3jjpj.exe18⤵
- Executes dropped EXE
PID:1772 -
\??\c:\frxfffr.exec:\frxfffr.exe19⤵
- Executes dropped EXE
PID:2492 -
\??\c:\xlxrxxl.exec:\xlxrxxl.exe20⤵
- Executes dropped EXE
PID:2112 -
\??\c:\htbhhh.exec:\htbhhh.exe21⤵
- Executes dropped EXE
PID:3060 -
\??\c:\vpdjp.exec:\vpdjp.exe22⤵
- Executes dropped EXE
PID:780 -
\??\c:\jvppp.exec:\jvppp.exe23⤵
- Executes dropped EXE
PID:1500 -
\??\c:\lxrrrxr.exec:\lxrrrxr.exe24⤵
- Executes dropped EXE
PID:820 -
\??\c:\xflxxxx.exec:\xflxxxx.exe25⤵
- Executes dropped EXE
PID:1872 -
\??\c:\1bnhnn.exec:\1bnhnn.exe26⤵
- Executes dropped EXE
PID:1164 -
\??\c:\thbnhb.exec:\thbnhb.exe27⤵
- Executes dropped EXE
PID:3024 -
\??\c:\vjdvj.exec:\vjdvj.exe28⤵
- Executes dropped EXE
PID:980 -
\??\c:\9lxllfl.exec:\9lxllfl.exe29⤵
- Executes dropped EXE
PID:1508 -
\??\c:\9rrrrrx.exec:\9rrrrrx.exe30⤵
- Executes dropped EXE
PID:1336 -
\??\c:\thtttt.exec:\thtttt.exe31⤵
- Executes dropped EXE
PID:2976 -
\??\c:\9jddv.exec:\9jddv.exe32⤵
- Executes dropped EXE
PID:2272 -
\??\c:\7pjjj.exec:\7pjjj.exe33⤵
- Executes dropped EXE
PID:2808 -
\??\c:\flrrllr.exec:\flrrllr.exe34⤵
- Executes dropped EXE
PID:1364 -
\??\c:\rlrxfxx.exec:\rlrxfxx.exe35⤵
- Executes dropped EXE
PID:1136 -
\??\c:\nhbhhh.exec:\nhbhhh.exe36⤵
- Executes dropped EXE
PID:2300 -
\??\c:\btttnh.exec:\btttnh.exe37⤵
- Executes dropped EXE
PID:2260 -
\??\c:\pdvpp.exec:\pdvpp.exe38⤵
- Executes dropped EXE
PID:2692 -
\??\c:\xlrrxrl.exec:\xlrrxrl.exe39⤵
- Executes dropped EXE
PID:2816 -
\??\c:\lrfxffl.exec:\lrfxffl.exe40⤵
- Executes dropped EXE
PID:2284 -
\??\c:\3rxrlfl.exec:\3rxrlfl.exe41⤵
- Executes dropped EXE
PID:2640 -
\??\c:\bthhnn.exec:\bthhnn.exe42⤵
- Executes dropped EXE
PID:2480 -
\??\c:\5hthbt.exec:\5hthbt.exe43⤵
- Executes dropped EXE
PID:2716 -
\??\c:\1pppj.exec:\1pppj.exe44⤵
- Executes dropped EXE
PID:2576 -
\??\c:\djjjv.exec:\djjjv.exe45⤵
- Executes dropped EXE
PID:2076 -
\??\c:\rrrrxrr.exec:\rrrrxrr.exe46⤵
- Executes dropped EXE
PID:3036 -
\??\c:\9lrrrrl.exec:\9lrrrrl.exe47⤵
- Executes dropped EXE
PID:2212 -
\??\c:\hbnttn.exec:\hbnttn.exe48⤵
- Executes dropped EXE
PID:1616 -
\??\c:\thhbbb.exec:\thhbbb.exe49⤵
- Executes dropped EXE
PID:940 -
\??\c:\dpjdv.exec:\dpjdv.exe50⤵
- Executes dropped EXE
PID:1824 -
\??\c:\pdjpv.exec:\pdjpv.exe51⤵
- Executes dropped EXE
PID:2016 -
\??\c:\7xxrllx.exec:\7xxrllx.exe52⤵
- Executes dropped EXE
PID:2164 -
\??\c:\lxrxxrx.exec:\lxrxxrx.exe53⤵
- Executes dropped EXE
PID:1724 -
\??\c:\ntbtbn.exec:\ntbtbn.exe54⤵
- Executes dropped EXE
PID:1680 -
\??\c:\hbbnhb.exec:\hbbnhb.exe55⤵
- Executes dropped EXE
PID:1572 -
\??\c:\5ttnhb.exec:\5ttnhb.exe56⤵
- Executes dropped EXE
PID:2872 -
\??\c:\7pjjv.exec:\7pjjv.exe57⤵
- Executes dropped EXE
PID:2092 -
\??\c:\5jvvp.exec:\5jvvp.exe58⤵
- Executes dropped EXE
PID:2116 -
\??\c:\lffrrfl.exec:\lffrrfl.exe59⤵
- Executes dropped EXE
PID:324 -
\??\c:\rfllxrx.exec:\rfllxrx.exe60⤵
- Executes dropped EXE
PID:1964 -
\??\c:\nttntt.exec:\nttntt.exe61⤵
- Executes dropped EXE
PID:780 -
\??\c:\nbnhhh.exec:\nbnhhh.exe62⤵
- Executes dropped EXE
PID:748 -
\??\c:\pdpvp.exec:\pdpvp.exe63⤵
- Executes dropped EXE
PID:2204 -
\??\c:\1vppv.exec:\1vppv.exe64⤵
- Executes dropped EXE
PID:328 -
\??\c:\flxrxxf.exec:\flxrxxf.exe65⤵
- Executes dropped EXE
PID:1872 -
\??\c:\nbnttn.exec:\nbnttn.exe66⤵PID:1848
-
\??\c:\5jpdj.exec:\5jpdj.exe67⤵PID:2072
-
\??\c:\1pvpp.exec:\1pvpp.exe68⤵PID:960
-
\??\c:\lxllffl.exec:\lxllffl.exe69⤵PID:2996
-
\??\c:\3xfxxrr.exec:\3xfxxrr.exe70⤵PID:1508
-
\??\c:\nthtbb.exec:\nthtbb.exe71⤵PID:3004
-
\??\c:\bhthhh.exec:\bhthhh.exe72⤵PID:2936
-
\??\c:\hntnnn.exec:\hntnnn.exe73⤵PID:2364
-
\??\c:\vdjjd.exec:\vdjjd.exe74⤵PID:2924
-
\??\c:\vdjpj.exec:\vdjpj.exe75⤵PID:2224
-
\??\c:\3lrffxx.exec:\3lrffxx.exe76⤵PID:1712
-
\??\c:\lfxfllx.exec:\lfxfllx.exe77⤵PID:1136
-
\??\c:\7bnbbt.exec:\7bnbbt.exe78⤵PID:2252
-
\??\c:\htnhtt.exec:\htnhtt.exe79⤵PID:1916
-
\??\c:\hnbtbt.exec:\hnbtbt.exe80⤵PID:2692
-
\??\c:\dvddj.exec:\dvddj.exe81⤵PID:2580
-
\??\c:\pdjdv.exec:\pdjdv.exe82⤵PID:2496
-
\??\c:\xlxfllr.exec:\xlxfllr.exe83⤵PID:2592
-
\??\c:\xllffxf.exec:\xllffxf.exe84⤵PID:2480
-
\??\c:\btbhtn.exec:\btbhtn.exe85⤵PID:2504
-
\??\c:\tnbbtn.exec:\tnbbtn.exe86⤵PID:2388
-
\??\c:\tnbbht.exec:\tnbbht.exe87⤵PID:2624
-
\??\c:\jpdjj.exec:\jpdjj.exe88⤵PID:3036
-
\??\c:\lxffffl.exec:\lxffffl.exe89⤵PID:1088
-
\??\c:\frrlrrl.exec:\frrlrrl.exe90⤵PID:1748
-
\??\c:\xrrffxl.exec:\xrrffxl.exe91⤵PID:1880
-
\??\c:\bntntt.exec:\bntntt.exe92⤵PID:1824
-
\??\c:\btnbtn.exec:\btnbtn.exe93⤵PID:1992
-
\??\c:\djpvv.exec:\djpvv.exe94⤵PID:2164
-
\??\c:\pjvvd.exec:\pjvvd.exe95⤵PID:1900
-
\??\c:\9dvvv.exec:\9dvvv.exe96⤵PID:1680
-
\??\c:\5flrxrx.exec:\5flrxrx.exe97⤵PID:2100
-
\??\c:\rxlfrrx.exec:\rxlfrrx.exe98⤵PID:2872
-
\??\c:\htntbb.exec:\htntbb.exe99⤵PID:2740
-
\??\c:\tbbttn.exec:\tbbttn.exe100⤵PID:2116
-
\??\c:\dvdpp.exec:\dvdpp.exe101⤵PID:1524
-
\??\c:\jvjdj.exec:\jvjdj.exe102⤵PID:1492
-
\??\c:\rlxflrl.exec:\rlxflrl.exe103⤵PID:1648
-
\??\c:\5lrfxrx.exec:\5lrfxrx.exe104⤵PID:956
-
\??\c:\1lxflll.exec:\1lxflll.exe105⤵PID:1284
-
\??\c:\btthnt.exec:\btthnt.exe106⤵PID:452
-
\??\c:\thtbhh.exec:\thtbhh.exe107⤵PID:2208
-
\??\c:\9vjpv.exec:\9vjpv.exe108⤵PID:1720
-
\??\c:\vpvvj.exec:\vpvvj.exe109⤵PID:1860
-
\??\c:\dvpvv.exec:\dvpvv.exe110⤵PID:960
-
\??\c:\rlrlrrr.exec:\rlrlrrr.exe111⤵PID:1272
-
\??\c:\7xxxxxr.exec:\7xxxxxr.exe112⤵PID:1508
-
\??\c:\thbthb.exec:\thbthb.exe113⤵PID:2188
-
\??\c:\thhnbb.exec:\thhnbb.exe114⤵PID:2936
-
\??\c:\vdddv.exec:\vdddv.exe115⤵PID:2868
-
\??\c:\vjdpp.exec:\vjdpp.exe116⤵PID:2924
-
\??\c:\rllfxxx.exec:\rllfxxx.exe117⤵PID:2912
-
\??\c:\5rrfrrf.exec:\5rrfrrf.exe118⤵PID:1608
-
\??\c:\rlflxrx.exec:\rlflxrx.exe119⤵PID:2564
-
\??\c:\btbhtt.exec:\btbhtt.exe120⤵PID:2560
-
\??\c:\btnthn.exec:\btnthn.exe121⤵PID:2260
-
\??\c:\dvjpv.exec:\dvjpv.exe122⤵PID:2692
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-